Detect DLL in Google Chronicle
Adversaries may abuse dynamic-link library (DLL) mechanisms to achieve persistence, privilege escalation, and defense evasion. Techniques include DLL search order hijacking (planting a malicious DLL earlier in the search path), DLL side-loading (placing a malicious DLL alongside a legitimate signed executable), phantom DLL hijacking (targeting references to non-existent DLLs), DLL substitution (replacing a valid DLL), and DLL redirection (using .manifest or .local files). Groups including Chimera, TONESHELL/Mustang Panda, Velvet Ant, APT41, and Aquatic Panda have extensively used these techniques to load malicious payloads under trusted process contexts.
MITRE ATT&CK
- Technique
- T1574 Hijack Execution Flow
- Sub-technique
- T1574.001 DLL
- Canonical reference
- https://attack.mitre.org/techniques/T1574/001/
YARA-L Detection Query
rule t1574_001_dll_hijacking_sideloading {
meta:
author = "Argus Detection Engineering"
description = "Detects DLL search order hijacking or side-loading where a trusted high-integrity process loads an unsigned or suspicious DLL from a user-writable path (T1574.001)"
mitre_attack_tactic = "Defense Evasion, Persistence, Privilege Escalation"
mitre_attack_technique = "T1574.001"
severity = "HIGH"
confidence = "HIGH"
events:
$e.metadata.event_type = "PROCESS_MODULE_LOAD"
$e.principal.process.file.full_path = /(?i)(\\windows\\system32\\|\\windows\\syswow64\\|\\program files)/
(
$e.target.file.full_path = /(?i)\\appdata\\local\\temp\\/ or
$e.target.file.full_path = /(?i)\\appdata\\roaming\\/ or
$e.target.file.full_path = /(?i)\\programdata\\/ or
$e.target.file.full_path = /(?i)\\users\\public\\/ or
$e.target.file.full_path = /(?i)\\windows\\temp\\/
)
not $e.target.file.full_path = /(?i)(\\windows\\system32\\|\\windows\\syswow64\\|\\program files)/
(
$e.target.file.pe_file.code_signature.signed = false or
$e.target.file.pe_file.code_signature.signature_status != "SIGNATURE_VALID"
)
condition:
$e
}Chronicle YARA-L 2.0 rule detecting T1574.001 DLL hijacking by matching PROCESS_MODULE_LOAD events where a trusted process (System32, SysWOW64, or Program Files) loads an unsigned or invalidly-signed DLL from a suspicious writable path such as AppData, ProgramData, or Windows\Temp. Covers DLL search order hijacking, side-loading, and phantom DLL attacks.
Data Sources
Required Tables
False Positives & Tuning
- Enterprise deployment tools that stage self-signed or internally-signed DLLs in ProgramData before a System32 process loads them as part of a sanctioned deployment workflow
- Remote monitoring and management (RMM) agents that operate from non-standard paths and load helper modules under a trusted parent process context
- Browser extension mechanisms or plugin frameworks where a signed browser loads extension DLLs from user profile AppData directories
Other platforms for T1574.001
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1DLL Search Order Hijacking via Phantom DLL
Expected signal: Sysmon Event ID 11 (FileCreate): Target file path containing 'dll-hijack-test\cryptsp.dll'. Sysmon Event ID 7 (ImageLoad) if the DLL is loaded. Process creation events showing calc.exe running from a non-standard path.
- Test 2DLL Side-Loading with Legitimate Signed Binary
Expected signal: Sysmon Event ID 11 (FileCreate): Legitimate executable copied to TEMP directory. Sysmon Event ID 1 (Process Create): Process launched from TEMP instead of its legitimate System32 home. File creation events in the temp directory.
- Test 3DLL Redirection via .local File
Expected signal: Sysmon Event ID 11 (FileCreate): .local file created alongside a legitimate executable copy. The presence of [executable].local causes Windows to prioritize the application's directory for all DLL searches, enabling DLL hijacking of any DLL that calc.exe imports.
References (7)
- https://attack.mitre.org/techniques/T1574/001/
- https://unit42.paloaltonetworks.com/dll-hijacking-techniques/
- https://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/
- https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows
- https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.001/T1574.001.md
- https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order
Unlock Pro Content
Get the full detection package for T1574.001 including response playbook, investigation guide, and atomic red team tests.